A missing authentication check in the Integrated Publishing Toolkit’s initial setup process remains exposed after the initial configuration is complete. This flaw allows a remote attacker who can authenticate (for example, through credentials stored or transmitted insecurely) to bypass authentication and acquire full administrative control of the system. The vulnerability is classified as CWE-306 and carries a CVSS score of 9.2, indicating a high likelihood of serious impact if exploited.

The affected product is GBIF Integrated Publishing Toolkit. Any installations running a version earlier than 3.3.4 are vulnerable, regardless of the operating system or host environment.

The CVSS score of 9.2 signifies a critical severity level. No EPSS score is currently posted, so the empirical probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description, as remote authenticated attackers can exploit the exposed endpoint. Attackers would need to reach the target system, typically via a network connection, and then exploit the exposed administrative endpoint to perform the bypass. Once bypassed, the attacker gains unrestricted administrative access, enabling full control of the application.